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Authorize host system to use 
protected information based 
upon value of authorization 
information (key selector). 
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Connect the portable authorization device to a 
host system. 
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Establish connection between the information 
authority and the portable authorization device. 



Authenticate the information authority and the 
the portable authorization device. 



Verify that the portable authorization device is 
authorized to receive a key selector associated 
with the protected information from the 
information authority (optional). 



Determine whether the key selector already 
exists in the portable authorization device. 
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Determine whether the key authorization 
counter is greater than zero. 



Transmit the key selector from the information 
authority to the portable authorization device. 



Encrypt and store the key selector in the 
portable authorization device. 
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Connect the portable authorization device to 
the host system associated with the item of 
protected information to be used. 




Start use of item of protected information 
associated with the host system. 
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Enter password for the portable authorization 
device and verify that password is correct 
(optional). 
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Transmit a challenge message from the host 
system to the portable authorization device. 
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Generate secret key from the key selector. 
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Generate and transmit a response message 
based on both the challenge message and the 
secret key to the host system. 
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Verify that the response message is the 
correct response to the challenge message. 
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Authorize the host system to transmit or 
access the item of protected information. 
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